Test-signing MagicAAP

[kernelb00t]

The problem: To install MagicAAP properly, I have to put Windows in test mode. This is not a proper way to install a custom driver, leading to increased attack surface and multiple insecurities. And it disables secure boot. And there are no updates for this driver. Great!

The solution: Following Microsoft recommendation for test drivers.

We do not have (and/or want?) a signing cert from Microsoft, so we have to manage our own.

The second problem: The signing process is slow and complex.

The second solution: A documentation, then maybe a script?

So, let's break it down :

1. Get Windows SDK and driver kit.
2. Check if signtool, mkcert are present.
3. Use mkcert to make a driver signing cert.
4. Install the certificate in the trust store.
5. Use signtool to sign the driver.
6. Install and reboot.

Are there any obstacles code-wise? Does the code use methods that ABSOLUTELY require test mode apart from the fact that the driver is not signed?

[steam3d]

Hi @kernelb00t . There are no ways of others. Please read this:
https://learn.microsoft.com/en-us/windows-hardware/drivers/install/driver-signing

Why the diver is not signed can be found in Discord

[kernelb00t]

https://learn.microsoft.com/en-us/windows-hardware/drivers/install/installing-test-signed-driver-packages
This is possible indeed!

You have to manage your certificate with a script. But you don't need to go test mode!

The link is talking about production use. But test use is still possible! I'm currently testing, and I'll update when it's OK.

[steam3d]

I don't think the Kernel Driver will work. Based on forums related to cheats, the Kernel Driver is used for game cheats and cannot be launched in the same way without test mode. Adding a certificate in Windows doesn't have any effect. Windows doesn't load such drivers.

My driver is Kernel Driver so it will not load without test mode.

[steam3d]

You can't load a kernel-mode driver with a self-signed certificate without Test Mode because Windows requires all drivers to be signed by a trusted certificate authority.

[steam3d]

So it makes no sense to sign, in test mode the signature is not needed